I have a client test app and a server app, both hosted on GAE. The client is a simple web front end, the server hosts resources protected by Oauth. Authentication is through OpenId and the applications support Federated Login. The problem is that after the user logs in, the userService seems to forget who they are (the browser has an ACSID cookie, so it remembers).
Here’s the flow (from the GAE logs)….
The user starts by entering cktestclient.appspot.com (the client app) into the browser and presses ShowMyCommitments button. Then the following is seen in the server side log (commitkeeperapi.appspot.com).
9:10:22 AM: /oauth/authorize?response_type=code&client_id=webappclient&redirect_uri=http://cktestclient.appspot.com/client/showStartPage&scope=CommitKeeper_Access
We aren’t logged in yet, so we will get redirected
9:10:22 AM: /login/?continue=http://commitkeeperapi.appspot.com/oauth/authorize?response_type=code&client_id=webappclient&redirect_uri=http://cktestclient.appspot.com/client/showStartPage&scope=CommitKeeper_Access
I then login using a url generated by createLoginURL
9:10:33 AM: /oauth/authorize?response_type=code&client_id=webappclient&redirect_uri=http://cktestclient.appspot.com/client/showStartPage&scope=CommitKeeper_Access
OAuth dance continues and we see that we have a logged in user
com.fourspires.api.server.MyGaeAuthenticator authenticate: Current user (from userService) is: richardlandis@gmail.com
9:10:34 AM: /oauth/access_token
More Oauth Dancing… getting oAuthToken, returning to client at cktestclient.appspot.com:/client/showStartPage – which continues to make a call at commitkeeperapi.appspot.com:/v3/commitments
9:10:34 AM: /oauth/validate
Dancing… validating oAuthToken that was sent with the request for commitments
9:10:36 AM: /v3/commitments/?oauth_token=9491caca6c9ad2b2cb2d20a5cf2773ce22b99e076ff0dcb3a47d06e6a26038d5ccf63c66f1f2387e
Now we are back on the server code and we check for the user – and it is null!
com.fourspires.api.util.UserHelpers getCurrentUser: UserServiceFactory.getUserService().getCurrentUser() = null
Based on reviewing all the threads I could on this issue, I added true to the server’s appengine-web.xml – but nothing changed.
Does anyone know why the UserService has lost track of my user? I have a workaround for this problem, but I was interested in understanding more about why this is failing.
PS – This seems very similar to GWT and AppEngine User Service but that doesn’t seem to have been resolved.
I believe that the answer is because that the two requests that I make are being handled by different ApiProxy’s, which have different environments and thus different understandings of who the current user is. I am not exactly sure why I am getting two different ApiProxys but I can do further investigation on that.